Search papers, labs, and topics across Lattice.
This paper introduces Universal Concept Disruption (UCD), a novel adversarial attack designed specifically for the SAM3 image segmentation model, which enhances promptable segmentation by integrating text-conditioned grounding. UCD generates a single bounded image perturbation from (image, noun-phrase) pairs, effectively disrupting the model's ability to recognize and segment concepts by targeting both the input and the visual feature extraction processes. The results show that UCD significantly degrades SAM3's performance across multiple datasets, with average mask AP dropping from 59.43 to 18.73, highlighting the model's vulnerability to adversarial attacks despite its advanced capabilities.
UCD reveals that even state-of-the-art segmentation models like SAM3 can be severely compromised by a single, cleverly crafted adversarial perturbation.
SAM3 extends promptable segmentation from geometry-driven mask prediction to open-vocabulary concept segmentation, where a text-conditioned grounding model decides whether a concept is present and segments all matching instances. While this presence-gated design improves concept-level prediction, its adversarial robustness remains unexplored. In this paper, we introduce Universal Concept Disruption (UCD), the first universal cross-concept adversarial attack tailored to SAM3 image segmentation. UCD learns a single bounded image perturbation from (image, noun-phrase) pairs and attacks SAM3 as an integrated concept-grounding system. It jointly disrupts the text-conditioned input path, maximizes divergence in prompt-shared visual features, suppresses the final presence-gated concept scores, and corrupts the spatial validity of retained masks through area collapse and clean-mask Dice disruption. Across SACo-Gold, LVIS, RefCOCO, PhraseCut, and OpenImages datasets, UCD consistently outperforms all baselines under a matched evaluation protocol, reducing average mask AP from 59.43 to 18.73 and average cgF1 from 50.32 to 20.49. The learned perturbation also transfers to SAM3.1 and to SAM3 video inference without re-optimization, while prompt ensembling, lightweight head fine-tuning, and temporal filtering provide limited recovery.
